PT-2025-18483 · Linux+1 · Linux Kernel+1

Published 2022-09-02 · Updated 2026-04-20 · CVE-2022-49766

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, related to the netlink protocol. The issue involves bounds-checking for the creation of the struct nlmsgerr, which is used to handle error messages. To address this, the code has been modified to use nlmsg put() instead of nlmsg put(), and a bounds check has been added to prevent potential field-spanning writes when using memcpy() on a composite flexible array struct. This change avoids a future run-time warning about a detected field-spanning write.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

AZL-69719

BDU:2026-04500

CVE-2022-49766

Affected Products

Debian

Linux Kernel

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49766.json · Exploit
• https://ubuntu.com/security/CVE-2022-49766 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49766 · Security Note
• https://osv.dev/vulnerability/AZL-69719 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-49766 · Vendor Advisory
• https://git.kernel.org/stable/c/710d21fdff9a98d621cd4e64167f3ef8af4e2fd1 · Patch
• https://bdu.fstec.ru/vul/2026-04500 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49766 · Vendor Advisory
• https://git.kernel.org/stable/c/aff4eb16f589c3af322a2582044bca365381fcd6 · Patch
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-49766 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49766 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49766 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49766 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49766 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note